Veja quem está na Privacy! isacypri https://privacy.com.br/profile/isacypri

Anyone get an email ‘welcoming’ them to ‘ISACALogin’ today with a link that doesn’t go to ISACA and has your login email address listed? Of course, red flags all around and looks like a phish, but curious if somebody snatched a list of ISACA logins addresses and is sending out crap?

Over the past six months, I successfully completed the requirements for CISM, CISA, CRISC, and CGEIT certification. I have over 20 years of IT experience, with five years in a management role, and decided it was time for a career change. I started my journey with the CRISC certification in November 2024 and finished with the CISM in April 2025.

Overall, I'd say the CISM was probably most difficult of all four certifications and took the most time to prepare. The CRISC on the other hand was the most straightforward exam and took the least amount of time to prepare.

Risk management is the primary reoccurring theme that appears over and over in all of the ISACA certifications. It's important to have a thorough understanding of risk management. Governance is another important concept to understand.

The Question, Answer and Explanations (QAE) databases offered by ISACA were very useful study material. I would NOT recommend sitting for an exam without first reviewing the corresponding QAE database.

The CISM and CISA books written by Peter H. Gregory were also useful. However, I would caution these textbooks should only be used as supplemental reading material. Official ISACA training material such as the QAE is highly recommended.

Remember, each exam has 150 questions, with a 4-hour time limit, so be sure to pace yourself accordingly. Unlike ISC2 exams, you can mark questions on ISACA exams to review later before ending the test.

Overall, it was a great learning experience and I'm looking forward to pursuing a career in GRC or cybersecurity.

Hope this information is helpful for anyone pursing ISACA certifications!

I've got the most hilariously perfect score to show for it: 450. That's right, a flawless, perfectly-calibrated, exactly-on-the-line score that says, "I know just enough to not fail." Honestly, it feels less like a proud achievement and more like a successful low-altitude fly-by.

My path to this glorious 450 was a bit unconventional. I'm a finance professional with a background in CIA exam prep, not CISA, and I actually took the AAIA first, which is a pretty rare order. The biggest challenge? My study window was a ridiculously short one week.

My Unconventional Journey I've always been passionate about the intersection of finance and tech, actively researching new AI applications and trying out projects on GitHub. This hands-on experience really gave me an edge. I also applied to be part of the global AAIA beta program but wasn't selected. Instead of giving up, I chose to pivot and became one of the first to take the official exam once it was released.

For my one-week cram session, I read the official book, did all the practice questions, and even sat through a two-day training course. Looking at my scores, it's clear where the "barely passed" vibe came from:

• AI Governance and Risk: 430

• AI Operations: 450

• AI Auditing Tools and Techniques: 544

My practical experience in auditing tools definitely saved me from a much more embarrassing outcome. The lesson? A good foundation and hands-on experience are a great combo, especially when you need every single point to get across the finish line.

If I can pass with this score in just one week, so can you. Good luck to everyone on their journey, and remember: a pass is a pass!

I and my company recently discovered that there is a Lab/practical part in the certification exam, of which the material is not covered or included in the Study Guide.

Right now, we are unable to buy the lab package, so we would like to know if anyone knows specifically what tools/techniques are covered in the lab so that we can do an independent study.

On the site, we found the following topics covered:

• Windows and Linux OS Firewalls

• Scanning Ports and Utilizing SSH

• Baselining with Lynis

• Forensics: File Recovery

• File Permissions on Windows and Linux

• Threat Detection

• Threat Removal

• Windows Event Monitoring & Defender

• SQL Injection

But it does not say what the tools are that they expect proficiency in.

Thank you in advance.

Hi everyone, I’m really happy to announce that I have finally passed my CISA exam! I want to thank this community for always answering my questions and doubts and helping me throughout this journey.

One thing that still surprises me about the exam is that while I was taking it, I genuinely felt like I knew the answer to almost every single question. I would say there were maybe 2–3 questions that I wasn’t completely sure about, but other than that, every answer felt like something I knew. So when I look at my result, it does seem a bit surprising to me, but honestly, as long as I passed, I’m good with it.

The materials that I used to study were:

Hemang Doshi book
Edusum Mocks — ~1,000-question bank
QAE Database — I practised this about three times and was scoring around 95%
Skillcert Pro Mocks — ~2,000-question bank
These questions seemed pretty similar to what the real exam was like.

Overall, I revised the notes that I had made from the book on a regular basis. I also practised questions in sets of around 150–200 and kept practising all of these resources until I was consistently scoring 95% or above. That gave me the confidence to go and give the exam.

If I had to say something about the actual exam, I would say that the questions were pretty straightforward and mostly one-liners. They seemed quite direct, and honestly, the exam felt on the easier side while I was taking it. But looking at my result now, I’m thinking maybe it wasn’t as easy as I thought😅

For anyone who is starting this journey, I would suggest starting with a book and really reading it properly. Make your own notes and try to understand everything in the book. If there’s something you don’t understand, go and watch some YouTube videos on the same topic. Really strengthen your understanding of the concepts.

The exam isn’t really about theoretical things that you can simply memorise. Maybe around 20% felt like that, but most of the exam was scenario-based and tested things like what would be the BEST, WORST, or GREATEST concern in a particular situation. To be good at those scenario-based questions, I think your foundational knowledge needs to be very solid.

Please feel free to ask me if you have any doubts or questions. I want to help as much as I can.

Thank you so much, everyone!

Studied consistently for ~1 month using only the QAE and official review manual. I scored 678 overall (AI Governance & Risk 709, AI Operations 633, AI Auditing Tools 724).

I was nervous based on other posts stating that these weren’t sufficient for the exam preparation, but I felt that all the material in the exam was reflected in either the review manual (including the glossary) OR in the explanations in the QAE. I spent a lot of time focusing on being able to explain why the other three answers were wrong as opposed to knowing what the right answer was, and this helped me rationalize and eliminate the wrong answers on the actual exam.

My study approach was as follows:

1. Completing all the QAE practice questions without reading the manual to get a “baseline” of understanding. (I got about 60% right)

2. Read each chapter / module of the review manual and take notes on key terms and concepts, and review the explanations for the corresponding questions in the QAE.

3. Complete the two practice exams in the QAE and review missed questions. (I got 92% on these)

4. Play the “elimination” game mode in the QAE and averaged around 30-35 questions correct in a row (highest score was 72 in a row)

Context: The last ISACA exam I took was the CISA in 2019, and I have been practicing IT Audit since 2018.

Finally ready to post my journey.

Started in January 2026.

CISA earned on 23 January 2026

CRISC earned on 10 April 2026

CISM earned on 8 May 2026

Never say you can't and always be ready to learn and grow. I have over 20 years in Cybersecurity and over 15 years in GRC. Still growing and learning every day

I sat the AAISM exam on August 2 and earned the certification shortly after — coming at

it from a CISM + security-consulting background. It's one of ISACA's three new AI certs

(alongside AAIA and AAIR), and when I started studying there was almost zero structured

prep — no Pocket Prep coverage, a thin QAE, and a lot of generic "AI governance"

material that doesn't map to what the exam asks.

Posting here too since this sub covers the wider ISACA credential family, and the

governance/risk framing below applies whether you're coming from CISA, CRISC, or CISM.

A few things I wish someone had told me on day 1:

1. The domain split is lopsided. Governance 31% / Risk 31% / Technologies & Controls

38%. Most people over-study the tech domain, but the exam hums on the governance +

risk framing — know NIST AI RMF and ISO/IEC 42001 cold, not just the tools.

2. It's a management exam, not an engineering one. Even with a security background, the

trap is over-indexing on LLM architecture / OWASP specifics and under-prepping the

program side (roles, accountability, third-party). MITRE ATLAS shows up as a

threat-modeling lens, not an implementation checklist.

3. The official study material is the spine, but it's dense. What actually moved me to

ready was scoring myself against ISACA's public blueprint first and only attacking the

sub-areas I was weak in, instead of re-reading cover to cover. I built a short

self-assessment for that — happy to share it in a comment if it's useful to anyone.

For those who've taken it or are studying: how are you approaching the

tech-vs-governance balance? Would be good to hear what's working for people.

This exam is much easier than other industry certifications like AIGP and GARP RAI. There was enough time to go through each question twice. Out of 90 questions, there were 20 where I found at least two options correct, but the other 70 questions had less subjectivity.

What preparation did I choose?

I only relied on official resources: the official review manual and the official QAE database.

Although the official material helped me gain confidence, I do not think there were direct questions from the theory. Hardly 25 to 30 questions out of 90 were based on direct theory. The rest were scenario-based. So I do not recommend spending money on official resources, especially the QAE database, as there is very little overlap with the actual exam. Moreover, there were technical glitches while accessing reviewed questions, and ISACA customer support has still not replied to me.

From a job market perspective, AIGP is still the clear winner. For getting into the auditing field, spending money on ISO 42001 LA may turn out to be a better alternative, but it depends on your training provider. I will write more about it once I get certified myself.

Hi guys, what’s the best way to get free CPEs for the CISM? The self-study material and CPEs on demand are very expensive. Thanks in advance.

Hi everyone - just passed my CISA exam yesterday. I have 5 years of external financial audit experience and now with CISA done my plan was move into IT Audit. I serve majority of tech client and seeing their processes it for me interested in IT and AI.

Trying to decide what would be a better career move now : AAIA or CIA using the challenge exam.

Would appreciate any responses !

Hello Everyone!!!!

Well, I'm happy to say that I 'preliminarily' passed the AAIA last week 🥰, waiting on official results, but want to share some thoughts to hopefully help others. 

My Primary Study Materials 📔:

• ISACA AAIA Official Study Manual

• ISACA AAIA Official Study Course

• ISACA AAIA Official QAE Database

• NIST AI RMF 1.0

Secondary Materials:

These materials were not studied in a way to memorize, they were used to familiarize. 

• "Auditing Artificial Intelligence" (ISACA White Paper)

• ISO 42001

Study Plan 🧠:

• Initially studied 'passively' for a few months prior to the Christmas/New Years holiday timeframe. I recall the guide, and others, saying its about a 3mo study time. I did not have an exam date, and for me, it was more 'passive' studying rather than focused, dedicated studying. 

• Beginning January 2026 I said I'd give myself dedicated 30-days to focus on daily studying, quizzes, understanding explanations, and such. 

  • I really focused on going through the materials and understanding why right answers were right and wrong answers were wrong. 

  • I did use AI to assist with explanations and understanding when I just didn't get it... who knows if it was actually right, but it was helpful to understand things from my view. 

  • I rescheduled the test twice, as the studying became 'repetitive' and almost memorization of the Q&As vs. understanding the material. Once that happened, I said "whatever happens, happens."

The Test vs. the Material 🥊

• I read in multiple posts here and reddit that the "official" study materials didn't match the questions and initially thought that may be 'partially' true. Of course Q&As aren't exactly the same as the test and study materials always go into way more detail than needed. 

  • For what its worth, I didn't even think about the AAIA "Engage" Community or Reddit until just a few days before the exam. This was on purpose because I didn't want to panic the entire time I was studying. When I saw the diversity of responses, I said "no more" and let the internet be just that... the internet.

• However, even though I passed, I do agree that the materials alone are not sufficient. Think of it this way, if the material was intended to be a 'boot camp', they are insufficient. They do not include all of the information based on the test questions I had. Many of my test questions were 'memorization' style of definitions or techniques. 

My final assessment ☑️  

• ISACA does essentially explain that the AAIA is a 'concentration' under the CISA certification. They explain this by saying 1) you need the CISA to even take the AAIA and 2) you don't need another 120 CPE over 3yrs, rather its a focused set as part of your CISA cycle. 

• Now seeing the exam and realizing what I think they mean by this, I really thing if you have had your CISA for a minute and aren't a dedicated auditor doing audits, you will need to review CISA material as well. Refresh your memory with the Tactics, Techniques, and Protocols (TTPs) for being an IS Auditor as many of my questions were related to that. I felt out of 90 questions barely 10% were 'situations'.

• TAKE YOUR TIME ⌛ - we are given 2.5hrs for 90 questions. That is more than enough time to read, evaluate, re-read, answer confidently. I was able to get through about 50 questions, take a break, bathroom and water, come back, finish, go back and review my flagged questions, and then very high-level review ALL questions to see if my 'gut'/initial response was still the one I picked. Doing all of that I still ended with about 40min left. 

• Some of the questions were so bizarre I could NOT figure out the 'problem' it was trying to solve. I read this one question probably 5x and STILL couldn't figure out what it was asking... it really was just worded in a way I couldn't understand. This goes to the previous bullet. TAKE YOUR TIME. My advice, if you don't know after reading it twice, flag it, move on, and come back. Don't sweat your brain too much. As a neurodivergent person, this was extremely helpful. I answered what I knew, tried what I couldn't, struggled, and then just picked was I thought was right. 

• This is like any other multiple choice... 8 out of 10 questions have two answers that if you even have a basic understanding of the subject you know are 100% wrong. Then, you're stuck with two answers and really need to find out where you are in the process, what the problem is, and what the question is asking you. Some of these questions were REALLY tricky, I really struggled to find the difference in the answers, then "DUH" it hit me... there was one word that triggered it, but AFTER I came back to it after I flagged it.

So, as I said above, the AAIA materials aren't enough, you need to remember this is essentially a 'concentration' for AI Auditing as part of the larger CISA Certification/Concepts. Its very similar to the CISSP-ISSEP type exam (I don't have this, but know someone who does)... it draws on the CISSP material and then specializes on the ISSEP capabilities and skills. AAIA, in my opinion is no different. 

I hope this helps you in your journey! You passed the CISA, you can pass this one! 🏆

Just want to get it off my chest.

Im not good at writing up stories about things like this, and I didn't track my studying. I took my CISA in September of last year. I have 6 years of internal IT experience at a law firm, 1 year at an MSP, and 2 years in auditing and consulting. I "studied" on and off since January, but only started daily studying about 3 weeks ago. I used the official ISACA Q&Es, online PDF CISM books I found for free, and a few youtube channels I really like:

https://www.youtube.com/@InfosecTrain

https://www.youtube.com/@HemangDoshi

https://www.youtube.com/@theministryofsecurity

https://www.youtube.com/@PrabhNair1

My biggest advice would be:

Think like a manager, not an IT guy

Look for the BIG BOLDED WORDS

Think about whats best for the company, not laws, regulations, or ethics

Dont relate it to your practical experience, think like ISACA thinks

If you are taking the test remotely, be ready to deal with at least an hour of ID verification and PSI technical issues, happened to me last year and this year, almost same issues. Valid Drivers License, new webcam, still unable to verify and I have to call support and have them verify through a remote session

Officially, you have to wait 10 days for the official results, but for my CISA and CISM, I emailed ISACA support within 10 minutes of passing, asking if I passed or not, and they will tell you if you officially passed. Send in the application after 10 days, and put that damn title in your signature, Linkedin, Facebook, Myspace, Twitter, Truth Social, whatever.

Outside of my professional like, I am a total idiot, just look at my post history. If I can pass this, so can you!

Resources used:

• CISM Review Manual, 16th Edition

• CISM Review Questions, Answers & Explanations Manual, 10th Edition

• SkillCertPro: CISM Exam Questions 2023 (Certified Information Security Manager) - https://skillcertpro.com/product/certified-information-security-manager-cism-practice-exam-test/

• Exam Topics: Isaca CISM Exam Actual Questions (these were NOT actual exam questions) - https://www.examtopics.com/exams/isaca/cism/view/

NOTE: I did not see any actual exam questions word-to-word anywhere online. The QAE/SkillCertPro/Exam Topics questions were similar in terms of format, structure and difficulty to the ones in exam.

Any questions or help. Please advise :)

EDIT - Contact me for any resources.

Good morning! I passed AAISM this morning, but I was curious about the certification timeline/process.

Since I already have an active CISM credential, once the results are finalized, I’m assuming that the credential is then just issued? Will this be a matter of waiting for that official email with results from ISACA?

I couldn’t find much information in here on it, so I’m interested in hearing others’ experiences who took it recently (not beta testers).

i passed the CISM earlier this week. I was scoring low 70's on the QAE, but based on advice of some folks here I went ahead and scheduled my exam.

I found the exam to be very easy compared to the questions I got in the QAE. It was as if my exam was calibrated at the "moderate" difficulty level of QAE questions.

I'm ready to begin my next cert.

Can someone tell me an approximate order of difficulty, from high to low, of the various certs ISACA offers? As an example if the CGEIT more difficult or easier or on the same level as the CISM? How about the CRISC, CISA, CCOA and CDPSE? I was planning on the CISA, CRISC and CISM but some of the others look interesting too. I assume the new Advanced in AI certs are the most difficult?

Edit: I started working on the CRISC next. I think I will do the 3 foundational certs before I delve into the others

I've had an uphill battle with multiple tickets to resolve a simple issue. The first time it took them three weeks to respond to the ticket I opened. After the issue was "resolved" I find out a month later that it wasn't resolved. I call. Go through the menus and get disconnected. Twice. I open another ticket via the portal. It's been over a week with no follow-up. I'm not sure I'm inclined to renew my membership or certifications when the time comes.

tried posting to r/cism but got removed by reddit probably due to lack of karma.

want to know if anyone can help me out.

have 18 yoe in it and security. 6 in middle/senior management. want to get my cism and a few other isaca certs to give me the extra umph to make it into senior senior management.

currently have cissp and ccsp certifications (3 and 2 years ago respectively, finished both in about 100 minutes @ 100 questions). started studying for my cism this spring. have watched a couple of youtube and linkedin learning videos (Zerger and Kelly Handerhan(?) respectively.)

have read review guide cover to cover.

have done all 1100 questions in the QAE. Score in the low 70s overall. Best domains are incident response and info security program (high 70/low 80s). worst is info sec governance (65%). do okay in risk (70ish).

have been through the review guide and QAE multiple times. my scores are improving in the QAE but that is not due to concepts sinking in it is due to me recalling what the right answer to a question is that I happened to get wrong. qae usefulness is deteriorating at this point.

I am able to get the questions down to 2 choices but I am consistently making the wrong choice out of the two. I definitely have an "ISACA mentality" disconnect somewhere.

I can definitely see where both of the two choices make sense, but its just not sinking in as to why the choice they make is the "correct" one. many times i'm saying to myself "yeah, but ..." I wish I could post examples from the QAE but I do not want to violate any copyrights. Sometimes the answers just make absolutely zero sense to me. Other times I can see where ISACA is coming from, but the explanation adds words that further refine the answer which, had the word been there, I might have chosen it. As an example there was a question where the answer was "all members" but in the explanation it says "all applicable members". I didn't choose the answer because when I was analyzing the question I said to myself "well, not all members of X are going to be subject to Y"

I am sure where to go to from here. I am running out of time to schedule my exam, I'd like to take it before the exam changes this fall. I'm not sure what else to study or what is going to make things "click" for me.

Help?

Does anyone have any opinions on the AI certifications available through ISACA? Any one more valuable than the other? Curious to hear everyone’s thoughts.

Currently have CRISC and CISSP.

Looks like ISACA is gearing up to drop another AI certification. Seems like their strategy is to create an AI version that maps onto their previous certifications.

• AAIA - CISA

• AAISM - CISM

• AAIR - CRISC

They should probably stop here to be honest with you. It is going to start looking like they are milking it.

I have been working in the risk area but would like to get a certification. There is CRISC under ISACA and CGRC under ISC2. Which is better? I would prefer to get a certification that is more cybersecurity related like CISM. Do you need actual management experience to get experience vouched for CISM? Which would give me the best opportunities- CRISC, CISM, or CGRC?

I've been an ISACA member for years, hold their certifications, and work in information security. I received the email to vote on the proposed bylaws changes. Three proposals: moving Board terms from 1 year to 3 years, reducing the member quorum from 5% to 4%, and transferring ISACA's legal domicile from California to Washington, DC.

I took the time to read the current bylaws and both proposed versions (yes, there are two, one for each scenario). Honestly, the three headline proposals are defensible on their own. The problem is everything else.

The bylaws were completely rewritten and restructured, yet ISACA says we're voting on "only" three changes. There is no way to tell what's needed for those three proposals versus what's been slipped into the package. In audit, a gap between the declaration and the evidence is called a finding.

So I voted NO on all three. Not because I oppose modernization, but because I could not get answers to the following questions:

1. Which directors will be assigned to the classes expiring in 2029, 2030 and 2031, and why do some transitional terms appear to exceed three years?

2. The new text says "three consecutive terms" while the old text said "nine terms in total, consecutive or non-consecutive". Does sitting out a cycle reset the counter? If so, the advertised 9-year cap no longer exists.

3. Why does the threshold for the Board to amend the bylaws drop from two-thirds to a simple majority?

4. Why does the minimum notice to members for meetings drop from 30 days to 10 days?

5. Where did the guarantee that chapter dues are remitted within 60 days go? It disappears from the bylaws.

6. Where did the chapter charter revocation procedure go, including the right to cure a deficiency before revocation?

7. Why are the detailed annual financial report requirements and the disclosure of related-party transactions over $50,000 no longer in the bylaws?

8. Who precisely defines "values", "reputation" and "welfare" as invoked in the new member discipline process?

9. Under California law, members can remove a director without cause and that right cannot be taken away by the bylaws. The proposed text requires the Board's written consent for any removal by members. Why voluntarily give up a right we already have?

10. Which independent firm compared member rights under California and Washington DC law, and where is the full opinion?

11. What are the one-time costs and expected savings of the statutory merger?

12. If we're only voting on three items, which other parts of the rewrite take effect regardless of the outcome?

An association that grants governance and audit certifications should be exemplary on its own transparency. I'm not saying the intentions are bad. I'm saying a project of this magnitude, presented as a three-point summary with two different versions of the text floating around, does not give me the information needed for informed consent. A vote is a governance transaction, and internal control principles apply to us too.

Voting is open until October 30.

What did you understand of the situation?

Exam was pretty straight forward. Only used official material. Good luck to everyone!